#1072666 virsh drvesx coredumps on invalid connect URL esx://x?no_verify (without =0)

Package:
libvirt-clients
Source:
libvirt-clients
Description:
Programs for the libvirt library
Submitter:
Trent W. Buck
Date:
2024-06-06 05:03:04 UTC
Severity:
normal
#1072666#5
Date:
2024-06-06 04:59:55 UTC
From:
To:
I normally use virsh -c qemu+ssh://, but
I noticed https://libvirt.org/drvesx.html exists, and I tried it out.

I accidentally did, which made virsh coredump (unexpected behaviour):

    virsh -c esx://x?no_verify

I should have done this, which exits with an error (expected behaviour):

    virsh -c esx://x?no_verify=0

I haven't checked the source yet, but
I guess there's a URL parser in handwritten C (rather than, say, lex + yacc), and
it needs some more fuzz tests.


Here is the output of "coredumpctl info":

               PID: 956182 (virsh)
               UID: 1000 (twb)
               GID: 1000 (twb)
            Signal: 11 (SEGV)
         Timestamp: Thu 2024-06-06 14:51:52 AEST (39s ago)
      Command Line: virsh $'--connect=esx://x?no_verify'
        Executable: /usr/bin/virsh
     Control Group: /user.slice/user-1000.slice/user@1000.service/app.slice/app-org.gnome.Terminal.slice/vte-spawn-2394d2ad-0c67-44b5-bfa5-7737eba911d2.scope
              Unit: user@1000.service
         User Unit: vte-spawn-2394d2ad-0c67-44b5-bfa5-7737eba911d2.scope
             Slice: user-1000.slice
         Owner UID: 1000 (twb)
           Boot ID: 61de1723deff475ab6121df0dd559048
        Machine ID: 029d2e3fb4ee4d5eaa67c315db3ba66d
          Hostname: hera
           Storage: /var/lib/systemd/coredump/core.virsh.1000.61de1723deff475ab6121df0dd559048.956182.1717649512000000.zst (present)
      Size on Disk: 460.0K
           Message: Process 956182 (virsh) of user 1000 dumped core.

                    Stack trace of thread 956182:
                    #0  0x00007ff6c0ca5e3a __libc_free (libc.so.6 + 0x98e3a)
                    #1  0x00007ff6c13c6549 n/a (libvirt.so.0 + 0x27a549)
                    #2  0x00007ff6c13bb8dd n/a (libvirt.so.0 + 0x26f8dd)
                    #3  0x00007ff6c13bc0e1 n/a (libvirt.so.0 + 0x2700e1)
                    #4  0x00007ff6c1439704 n/a (libvirt.so.0 + 0x2ed704)
                    #5  0x00007ff6c143a080 virConnectOpenAuth (libvirt.so.0 + 0x2ee080)
                    #6  0x00005595d686f0ef n/a (virsh + 0x400ef)
                    #7  0x00005595d686f3c3 n/a (virsh + 0x403c3)
                    #8  0x00005595d686e9db n/a (virsh + 0x3f9db)
                    #9  0x00007ff6c0c3424a n/a (libc.so.6 + 0x2724a)
                    #10 0x00007ff6c0c34305 __libc_start_main (libc.so.6 + 0x27305)
                    #11 0x00005595d686ece1 n/a (virsh + 0x3fce1)

                    Stack trace of thread 956183:
                    #0  0x00007ff6c0d0915f __poll (libc.so.6 + 0xfc15f)
                    #1  0x00007ff6c0ebc9ae n/a (libglib-2.0.so.0 + 0x549ae)
                    #2  0x00007ff6c0ebcacc g_main_context_iteration (libglib-2.0.so.0 + 0x54acc)
                    #3  0x00007ff6c121e5e0 virEventGLibRunOnce (libvirt.so.0 + 0xd25e0)
                    #4  0x00005595d68ba7c5 n/a (virsh + 0x8b7c5)
                    #5  0x00007ff6c1272ad7 n/a (libvirt.so.0 + 0x126ad7)
                    #6  0x00007ff6c0c96134 n/a (libc.so.6 + 0x89134)
                    #7  0x00007ff6c0d167dc n/a (libc.so.6 + 0x1097dc)
                    ELF object binary architecture: AMD x86-64